Google Chrome EUVD-2026-65776

Exploitation requires the victim to be running Google Chrome prior to 152.0.7977.65 on any desktop platform. The attacker must deliver a crafted HTML page to the target - typically via phishing or a malicious link - and the victim must be successfully social engineered into interacting with the misleading UI element (UI:R per CVSS). No special server-side configuration, authenticated access, or non-default Chrome settings are required; however, the social engineering dependency is the primary limiting factor. Exploitation is constrained to scenarios where the attacker can reach the victim's browser with a crafted page and influence user behavior. The vulnerability does not allow passive, zero-click, or automated mass exploitation without user interaction.

The CVSS 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects a network-exploitable, low-complexity attack with no privilege requirement, but mandating user interaction - which is the critical limiting factor here. The social engineering dependency substantially reduces real-world exploitation at scale compared to a fully-automated flaw. EPSS at 0.39% (32nd percentile) corroborates this: despite the high CVSS score, exploitation probability remains low, consistent with the UI:R constraint. There is no CISA KEV listing and no reported POC, further supporting a 'monitor and patch' rather than 'emergency response' posture for most organizations. The high C and I scores are plausible given that successfully deceiving a user about browser context can lead to credential theft or unauthorized permission grants. The 'Authentication Bypass' tag in the input data is potentially misleading - this is a spoofing/visual deception class (CWE-451), not a cryptographic or session-management bypass; security teams should classify and triage accordingly.

An attacker hosts a crafted HTML page designed to visually impersonate a legitimate origin - for example, mimicking a browser permission dialog or address bar display - and distributes a link via phishing email or social media. A Chrome user prior to 152.0.7977.65 visits the page, is deceived by the misrepresented UI into believing they are interacting with a trusted site, and grants permissions or submits credentials that the attacker then captures or uses to bypass access restrictions. No public POC is known, and successful exploitation requires the victim to be socially engineered into interacting with the malicious page.